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Independent Orbiter Assessment 
Analysis of the Elevon Subsystem 


1 . 0 EXECUTIVE SUMMARY 

The McDonnell Douglas Astronautics Company (MDAC) was selected in 
June 1986 to perform an Independent Orbiter Assessment (IOA) of 
the Failure Modes and Effects Analysis (FMEA) and Critical Items 
List (CIL). Direction was given by the STS Orbiter and GFE 
Projects Office to perform the hardware analysis using the 
instructions and ground rules defined in NSTS 22206 , Instructions 
for Preparation of FMEA and CIL , 10 October 1986 . The IOA 
approacn features a top-down analysis of the hardware to 
determine failure modes, criticality, and potential critical 
items. To preserve independence, this analysis was accomplished 
without reliance upon the results contained within the NASA 
FMEA/CIL documentation. This report documents (Appendix C) the 
independent analysis results for the Orbiter Elevon system 
hardware. 

The elevon actuators are located at the trailing edge of the wing 
surface as shown in Figure 1 . The proper function of the elevons 
is essential during the dynamic flight phases of ascent and 
entry. During flight, the Orbiter is controlled, in part, by four 
aerosurfaces called elevons. An elevon is a control surface which 
performs the same functions as an elevator and an aileron on a 
conventional airplane. In the ascent phase of flight, the elevons 
are used for relieving high wing loads. For entry, the elevons 
are used to pitch and roll the vehicle. 

Specifically, the elevon system hardware comprises the following 
components : 

o Flow Cutoff Valve 

o Switching Valve 

o Electro-Hydraulic (EH) Servoactuator 
o Secondary Delta Pressure Transducer 
o Bypass Valve 
o Power Valve 
o Power Valve Check Valve 
o Primary Actuator 

o Primary Delta Pressure Transducer 
o Primary Actuator Position Transducer 
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The IOA analysis process utilized available elevon hardware 
drawings and schematics for defining hardware assemblies, 
components , and hardware items . Each level of hardware was 
evaluated and analyzed for possible failure modes and effects. 
Criticality was assigned based upon the severity of the effect 
for each failure mode. 

Figure 1 presents a summary of the failure criticalities for each 
of the elevon system hardware components. A summary of the 
number of failure modes, by criticality, is also presented below 
with Hardware (HW) criticality first and Functional (F) 
criticality second. 


+ + 

I Summary of IOA Failure Modes By Criticality (HW/F) j 


Criticality: 

1/1 

2/1R 

2/2 

3/1R 

3/2R 

3/3 

TOTAL 

Number : 

L 

8 

9 

- 

3 

- 

5 

25 


For each failure mode identified, the criticality and redundancy 
screens were examined to identify critical items. A summary of 
Potential Critical Items (PCIs) is presented as follows: 


+ + 

I Summary of IOA Potential Critical Items (HW/F) I 


Criticality: 

1/1 

2/1R 

2/2 

3/1R 

3/2R 

TOTAL 

Number : 

h 

8 

9 

- 

1 

- 

18 


Of the 25 failure modes analyzed, 18 were determined to be PCIs. 


PRIMARY ACTUATOR 1 I SWITCHING VALVE ASSY I I EH SERVOVALVE ASSY] I POWER SPOOL VALVE ASSY 



Figure 1 - ELEVON ANALYSIS SUMMARY 
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PROFILE VIEW OF ACTUATOR (1 OF 4) 










2 . 0 INTRODUCTION 

2 . 1 Purpose 

The 51-L Challenger accident prompted the NASA to readdress 
safety policies, concepts, and rationale being used in the 
National Space Transportation System (NSTS). The NSTS Office has 
undertaken the task of reevaluating the FMEA/CIL for the Space 
Shuttle design. The MDAC is providing an independent assessment 
of the Orbiter FMEA/CIL for completeness and technical accuracy. 


2 . 2 Scope 

The scope of the independent FMEA/CIL assessment activity 
encompasses those Shuttle Orbiter subsystems and GFE hardware 
identified in the Space Shuttle independent FMEA/CIL Assessment 
Contractor Statement of Work. Each subsystem analysis addresses 
hardware, functions, internal and external interfaces, and 
operational requirements for all mission phases. 


2.3 Analysis Approach 

The independent analysis approach is a top-down analysis 
utilizing as-built drawings to breakdown the respective subsystem 
into components and low-level hardware items. Each hardware item 
is evaluated for failure mode, effects, and criticality. These 
data are documented in the respective subsystem analysis report, 
and are used to assess the NASA and Prime Contractor FMEA/CIL 
reevaluation results. The IOA analysis approach is summarized in 
the following Steps 1.0 through 3.0. Step 4.0 summarizes the 
assessment of the NASA and Prime Contractor FMEAs/CILs that is 
performed and documented at a later date. 


Step 1.0 Subsystem familiarization 

1.1 Define subsystem functions 

1.2 Define subsystem components 

1.3 Define subsystem specific ground rules and 
assumptions 

Step 2.0 Define subsystem analysis diagram 

2 . 1 Define subsystem 

2.2 Define major assemblies 

2 . 3 Develop detailed subsystem representations 

Step 3.0 Failure events definition 

3.1 Construct matrix of failure modes 

3 . 2 Document IOA analysis results 
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Step 4.0 Compare IOA analysis data to NASA FMEA/CIL 

4.1 Resolve differences 

4 . 2 Review in-house 

4 . 3 Document assessment issues 

4.4 Forward findings to Project Manager 


2.4 Elevon Ground Rules and Assumptions 

The elevon ground rules and assumptions used in the IOA are 
defined in Appendix B. 


3 . 0 SUBSYSTEM DESCRIPTION 


The following sections describe the elevon actuator system 
hardware. Each of the four elevon actuator systems (Figure 2) 
comprise the following components: a flow cutoff valve, switching 
valve, EH servoactuator, secondary pressure transducer, bypass 
valve, power valve, primary actuator, primary actuator delta 
pressure transducer, and primary actuator position transducer. 

3.1 Elevon Design and Function 

The elevon actuators are located at the trailing edge of the wing 
surface. The proper function of the elevons is essential during 
the dynamic flight phases of ascent and entry. During flight the 
Orbiter is controlled, in part, by four aerosurfaces called 
elevons. An elevon is a control surface which performs the same 
functions as an elevator and an aileron on a conventional 
airplane. In the ascent phase of flight, the elevons are used 
for relieving high wing loads. For entry, the elevons are used 
to pitch and roll the vehicle. 

Each elevon actuator is driven by one primary actuator. Control 
of the actuator is provided by four EH servovalves. These 
servovalves are used to create a secondary delta pressure which 
controls the flow of hydraulic fluid to one power valve. This 
power valve, when actuated, diverts fluid to the primary actuator 
(Figure 3 ) . 

The flow cutoff valve (or low-pressure bypass valve) is used to 
circulate hydraulic fluid during certain thermally cold periods . 
The flow cutoff valve should be opened during circulation pump 
operations only. The flow cutoff valve must be closed during 
high-pressure operations or degraded elevon performance will 
result . 

The switching valve diverts pressure from one of the Orbiter 's 
three hydraulic systems to supply adequate fluid and pressure to 
the primary and secondary elevon hydraulic system. The switching 
valve (Figure 4) contains two pistons, a primary and a secondary. 
If the pressure in the primary Orbiter hydraulic system drops 
below 1200 to 1500 psi, the switching valve primary piston will 
translate and allow the secondary hydraulic system to provide the 
required fluid and pressure to the downstream actuators. If the 
second hydraulic system is unable to provide pressure above 1200 
to 1500 psi, the second switching valve piston will translate 
allowing the third hydraulic system to provide pressure to the 
actuator and servovalves. Linear Variable Differential 
Transformers ( LVDTs ) attached to the switching valve pistons 
indicate to the crew which hydraulic system is powering the 
elevon . 
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Figure 4 - SWITCHING VALVE 
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The many small passages, orifices, and restrictions in the 
secondary side of the servovalve assembly are highly sensitive to 
contaminants which enter the hydraulic system. A 15 micron 
filter conditions the hydraulic fluid which supplies the 
secondary side of the actuation system. 

The elevon bypass valve is used to isolate an erroneous 
servovalve output from influencing the power valve movement. If 
secondary delta pressure exceeds 2200 psi for 120 milliseconds, 
the bypass valve diverts fluid away from the power spool to the 
return, preventing the erroneous or failed channel from creating 
a potential force- fight or incorrectly influencing power spool 
and elevon motion. 

The secondary delta pressure transducers are used to measure the 
instantaneous pressure differential between the hydraulic source 
(nominally 3000 psi) and the servovalve reduced pressure. The 
transducer comprises a dual-spring balanced piston and a lvdt 
which transmits a transducer piston position in the form of a 
voltage to the Aerosurface Servo Amplifier (ASA) . The ASA can use 
this voltage to determine the delta pressure across the 
corresponding servovalve. This information is used to bias 
equalization of four servovalve channels and activate their 
corresponding bypass valves when a channel cutoff is required. 

The power valve combines four servovalve induced secondary delta 
pressures into a translation representing the commanded elevon 
movement. As the power valve moves, it allows a primary pressure 
to translate the primary actuator and its corresponding elevon. 
When one of the four secondary pressures are bypassed or 
erroneous, the remaining three pressures will overdrive the power 
valve. 

The primary actuator is responsible for the ultimate motion of 
the elevon. It is controlled by a secondary pressure power valve 
which diverts primary hydraulic fluid and pressure to the 
actuator (Figure 5). 

The primary delta pressure transducer is used to measure the 
instantaneous pressure differential across the primary actuator. 
The transducer comprises a dual-spring balanced piston and a LVDT 
which transmits a transducer piston position in the form of a 
voltage to the ASA. The ASA uses this voltage to determine the 
delta pressure across the primary actuator. 

The position feedback transducer feeds the instantaneous position 
of the elevon to the ASA and General Purpose Computers (GPCs). 

The transducer consists of a LVDT calibrated to feedback a 
position voltage to the ASA. This information is used by th ASA 
for servovalve biasing and to the GPCs for Flight Control System 
(FCS) and caution and warning inputs. The current elevon position 
is displayed to the crew on the surface position indicators on 
Panel F7 . 
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Figure 5 - ELEVON ACTUATOR 
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3.2 interfaces and Locations 


The elevon system hardware is located at the trailing edge of the 
Orbiter's wings. The elevon system interfaces with the Orbiter's 
three hydraulic systems, each corresponding to one Auxiliary 
Power Unit (APU). The elevon system hardware interfaces with the 
ASAs which in turn interface with the FCS portion of the GPCs for 
system control, fault detection, actuation and feedback. 


3 . 3 Hierarchy 

Figure 2 illustrates the hierarchy of the elevon hardware and 
corresponding subcomponents. Figures 3 through 5 comprise the 
detailed system representations . 
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4.0 ANALYSIS RESULTS 


The elevon system schematic is depicted in Figure 2. The 
functional representation of the major system components is shown 
in Figures 3 and 4. 

Detailed analysis results for each of the identified failure 
modes are presented in Appendix C. Table I presents a summary of 
the failure criticalities. Note that the tables below are 
divided into two groups: one for the primary actuator and 

related components and one for the secondary actuator and 
associated control items. Further discussion of each of these 
subdivisions and the applicable failure modes is provided in 
subsequent paragraphs. 


4.1 Primary Actuator Analysis 

This section describes failure modes analyzed in the primary 
actuator, primary actuator heaters, primary actuator delta 
pressure transducer and primary actuator position transducer. 
The failures analyzed for these components includes: internal 

and external leakage, structural failure, loss of or erroneous 
output, and heaters failing on or off. 


4.2 Secondary Actuator Control Analysis 

This section describes failure modes analyzed in the flow cutoff 
valve, switching valve, secondary system filter, EH servo valve, 
secondary delta pressure transducer, bypass valve, power valve 
and the power valve check valve. The failures analyzed for these 
components includes: internal leakage, seal failure, restricted 

flow, component rupture, jammed piston or valves, failure to 
switch, loss of output, and units failing open or closed. 
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Of these 25 failure modes analyzed, 18 were determined to be 
PCIs. A summary of the PCIs is presented in Table II. Appendix 
D contains a cross-reference between each PCI and a specific 
analysis worksheet in Appendix C. 


+ + 


TABLE II Summary of IOA Potential Critical Items 


-1 

r- — -1 

H 

^ 

H 

h — H 

h 

Criticality: 

l/i 

2/1R 

2/2 

3/1R 

3/2R 

TOTAL 

o Primary 
Actuator 







Primary 

Actuator 

2 

- 

- 

1 


3 

Prim. Act. 

DP Transducer 

- 

- 

- 

- 

- 

- 

Prim. Act. 

Position 

Transducer 

j 

1 



. 

. 

1 

o Secondary 
Actuator 







Flow Cutoff 
Valve 

1 

- 

- 

- 

- 

- 

Switching VLV 

1 

2 

- 


- 

3 

EH Servo VLV 

1 

3 




4 

Secondary DP 
Transducer 

- 

1 


- 

- 

1 

Bypass VLV 

- 

2 

- 

- 

- 

2 

Power vlv 

2 

- 

- 

- 

- 

2 

Power VLV 
Check VLV 

1 

1 

- 

- 

- 

2 

TOTAL 

8 

9 

- 

1 

- 

18 
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Hydraulic Subsystem 
Rockwell International 


16 


I 1 1 


APPENDIX A 
ACRONYMS 


APU 

- 

Auxiliary Power Unit 

ASA 

- 

Aerosurface Servo Amplifier 

ASSY 

- 

Assembly 

CIL 

- 

Critical Items List 

EH 

- 

Electro-Hydraulic 

FCS 

- 

Flight Control System 

FM 

- 

Failure Mode 

FMEA 

— 

Failure Modes and Effects Analysis 

F 

— 

Functional 

GFE 

- 

Government Furnished Equipment 

GPC 

- 

General Purpose Computer 

HW 

- 

Hardware 

IOA 

- 

Independent Orbiter Assessment 

LVDT 

— 

Linear Variable Differential Transformer 

MDAC 

- 

McDonnell Douglas Astronautics Company 

NA 

- 

Not Applicable 

NASA 

- 

National Aeronautics and Space Administration 

NSTS 

- 

National Space Transportation System 

PCI 

- 

Potential Critical Item 

psi 

— 

Pounds Per Square Inch 

psid 

- 

Pounds Per Square Inch Differential 

RI 

- 

Rockwell International 

VLV 

- 

Valve 

xducer 

- 

Transducer 
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DEFINITIONS, GROUND RULES, AND ASSUMPTIONS 


B.l Definitions 

B.2 Project Level Ground Rules and Assumptions 
B.3 Subsystem-Specific Ground Rules and Assumptions 
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APPENDIX B 

DEFINITIONS, GROUND RULES, AND ASSUMPTIONS 


B.l Definitions 

Definitions contained in NSTS 22206 , Instructions For Preparation 
of FMEA/CIL , 10 October 1986 , were used with the following 
amplifications and additions. 

INTACT ABORT DEFINITIONS: 

RTLS - begins at transition to OPS 6 and ends at transition 
to OPS 9, post-flight 

TAL - begins at declaration of the abort and ends at 
transition to OPS 9, post-flight 

AQA - begins at declaration of the abort and ends at 
transition to OPS 9, post-flight 

ATO - begins at declaration of the abort and ends at 
transition to OPS 9, post-flight 

CREDIBLE ( CAUSE ) - an event that can be predicted or expected in 
anticipated operational environmental conditions. Excludes an 
event where multiple failures must first occur to result in 
environmental extremes 

CONTINGENCY CREW PROCEDURES - procedures that are utilized beyond 
the standard malfunction procedures, pocket checklists, and cue 
cards 

EARLY MISSION TERMINATION - termination of onorbit phase prior to 
planned end of mission 

EFFECTS /RATIONALE - description of the case which generated the 
highest criticality 

HIGHEST CRITICALITY - the highest functional criticality 
determined in the phase-by-phase analysis 

MAJOR MODE (MM) - major sub-mode of software operational seouence 
(OPS) 

MC - Memory Configuration of Primary Avionics Software System 
(PASS) 

MISSION - assigned performance of a specific Orbiter flight with 
payload/obj ective accomplishments including orbit phasing and 
altitude (excludes secondary payloads such as GAS cans, 
middeck P/L, etc.) 
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MULTIPLE ORDER FAILURE - describes the failure due to a single 
cause or event of all units which perform a necessary (critical) 
function 

OFF-NOMINAL CREW PROCEDURES - procedures that are utilized beyond 
the standard malfunction procedures , pocket checklists , and cue 
cards 

OPS - software operational sequence 

PRIMARY MISSION OBJECTIVES - worst case primary mission objec- 
tives are equal to mission objectives 

PHASE DEFINITIONS : 

PRELAUNCH PHASE - begins at launch count-down Orbiter 
power-up and ends at moding to OPS Major Mode 102 (liftoff) 

LIFTOFF MISSION PHASE - begins at SRB ignition (MM 102) and 
ends at transition out of OPS 1 (Synonymous with ASCENT) 

ONORBIT PHASE - begins at transition to OPS 2 or OPS 8 and 
ends at transition out of OPS 2 or OPS 8 

DEORBIT PHASE - begins at transition to OPS Major Mode 
301 and ends at first main landing gear touchdown 

LANDING/SAFING PHASE - begins at first main gear 
touchdown and ends with the completion of post-landing 
safing operations 
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APPENDIX B 

DEFINITIONS, GROUND RULES, AND ASSUMPTIONS 


B . 2 IOA Project Level Ground Rules and Assumptions 

The philosophy embodied in NSTS 22206 , Instructions for 
Preparation of FMEA/CIL, 10 October 1986 , was employed with the 
following amplifications and additions. 


1. The operational flight software is an accurate 
implementation of the Flight System Software Requirements 
(FSSRs ) . 

RATIONALE: Software verification is out-of-scope of 
this task. 

2. After liftoff, any parameter which is monitored by system 
management (SM) or which drives any part of the Caution and 
Warning System (C&W) will support passage of Redundancy 
Screen B for its corresponding hardware item. 

RATIONALE: Analysis of on-board parameter availability 
and/or the actual monitoring by the crew 
is beyond the scope of this task. 

3. Any data employed with flight software is assumed to be 
functional for the specific vehicle and specific mission 
being flown. 

RATIONALE: Mission data verification is out-of-scope of 
this task. 

4. All hardware (including firmware) is manufactured and 
assembled to the design specifications/drawings. 

RATIONALE: Acceptance and verification testing is 

designed to detect and identify problems 
before the item is approved for use. 

5. All Flight Data File crew procedures will be assumed 
performed as written, and will not include human error in 
their performance. 

RATIONALE: Failures caused by human operational error 
are out-of-scope of this task. 
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6. All hardware analyses will, as a minimum, be performed at 
the level of analysis existent within NASA/Prime Contractor 
Orbiter FMEA/CILs , and will be permitted to go to greater 
hardware detail levels but not lesser. 

RATIONALE: Comparison of IOA analysis results with 

other analyses requires that both analyses 
be performed to a comparable level of 
detail . 

7. Verification that a telemetry parameter is actually 
monitored during AOS by ground-based personnel is not 
required . 

RATIONALE: Analysis of mission-dependent telemetry 

availability and/or the actual monitoring of 
applicable data by ground-based personnel is 
beyond the scope of this task. 

8. The determination of criticalities per phase is based on the 
worst case effect of a failure for the phase being analyzed. 
The failure can occur in the phase being analyzed or in 

any previous phase, whichever produces the worst case 
effects for the phase of interest. 

RATIONALE: Assigning phase criticalities ensures a 
thorough and complete analysis. 

9. Analysis of wire harnesses, cables and electrical connectors 
to determine if FMEAs are warranted will not be performed 
nor FMEAs assessed. 

RATIONALE: Analysis was substantially complete prior 

to NSTS 22206 ground rule redirection. 

10. Analysis of welds or brazed joints that cannot be inspected 
will not be performed nor FMEAs assessed. 

RATIONALE: Analysis was substantially complete prior 

to NSTS 22206 ground rule redirection. 

11. Emergency system or hardware will include burst discs and 
will exclude the EMU Secondary Oxygen Pack (SOP), pressure 
relief valves and the landing gear pyrotechnics . 

RATIONALE: Clarify definition of emergency systems to 
ensure consistency throughout IOA project. 
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APPENDIX B 

DEFINITIONS, GROUND RULES, AND ASSUMPTIONS 

B . 3 Elevon-Specific Ground Rules and Assumptions 
None. 
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APPENDIX C 
DETAILED ANALYSIS 


This section contains the IOA analysis worksheets generated 
during the analysis of this subsystem. The information on these 
worksheets is intentionally similar to the NASA FMEAs . Each of 
these sheets identifies the hardware item being analyzed, and 
parent assembly, as well as the function. For each failure mode, 
the possible causes are outlined, and the assessed hardware and 
functional criticality for each mission phase is listed, as 
described in the NSTS 22206, Instructions for Preparation of FMEA 
and CIL, 10 October 1986. Finally, effects are entered at the 
bottom of each sheet, and the worst case criticality is entered 
at the top. 


LEGEND FOR IOA ANALYSIS WORKSHEETS 


Hardware Criticalities: 

1 - Loss of life or vehicle 

2 « Loss of mission or next failure of any redundant item 

(like or unlike) could cause loss of life/vehicle 

3 - All others 


Functional Criticalities: 

1R - Redundant hardware items (like or unlike) all of which, 
if failed, could cause loss of life or vehicle. 

2R - Redundant hardware items (like or unlike) all of which, 
if failed, could cause loss of mission. 

Redundancy Screen A: 

1 - Is Checked Out PreFlight 

2 - Is Capable of Check Out PreFlight 

3 - Not Capable of Check Out PreFlight 
NA - Not Applicable 

Redundancy Screens B and C: 

P - Passed Screen 
F - Failed Screen 
NA = Not Applicable 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 02/86 

ELEVON 

101 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: FLOW CUTOFF VALVE 

FAILURE MODE: FAILS OPEN 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 

BREAKDOWN HIERARCHY: 

1) ELEVON 

2) FLOW CUTOFF VALVE 

3) 

4) 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 

3/3 

ATO: 

3/3 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: WING TRAILING EDGE 

PART NUMBER: MC621-0014 


CAUSES: CONTAMINATED HYDRAULIC SYSTEM 

EFFECTS/RATIONALE : 

FAILS OPEN DURING HIGH PRESSURE OPERATION-SLIGHT LOSS OF SYSTEM 
PRESSURE; NOMINALLY OPEN AT LOW PRESSURE OPERATION. 


REFERENCES : 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 02/86 

ELEVON 

102 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: FLOW CUTOFF VALVE 

FAILURE MODE: FAILS CLOSED 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) ELEVON 

2) FLOW CUTOFF VALVE 

3) 

4) 

5) 

6 ) 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AOA: 

3/3 

DEORBIT: 

3/3 

ATO: 

3/3 

LANDING/ SAFING: 3/3 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 

LOCATION: WING 

TRAILING EDGE 



PART NUMBER: MC621 

-0014 




CAUSES: CONTAMINATED HYDRAULIC SYSTEM 

EFFECTS/RATIONALE : 

FAILS DURING LOW PRESSURE OPERATION; HEATERS CONDITION THE 
SYSTEM-NO OPERATIONAL AFFECT. NOMINALLY CLOSED AT HIGH PRESSURE 
OPERATION. 


REFERENCES : 


C-3 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 02/86 

ELEVON 

103 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: SWITCHING VALVE 

FAILURE MODE: SEAL FAILURE 


LEAD ANALYST: J. RICCIO 


SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) ELEVON 

2) FLOW CUTOFF VALVE 

3) SWITCHING VALVE 

4) 

5) 

6 ) 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE HDW/FUNC ABORT 

PRELAUNCH: 3/3 RTLS: 

LIFTOFF: 3/3 TAL: 

ONORBIT: /NA AO A: 

DEORBIT: 2/1R ATO: 

LANDING/S AFING: 3/3 


HDW/FUNC 

2/IR 

2/1R 

2/IR 

2/lR 


REDUNDANCY SCREENS: A [ 2 ] B [ P ] 


C [ P ] 


LOCATION: WING TRAILING EDGE 

PART NUMBER: MC62 1-0014 


CAUSES: CONTAMINATED HYDRAULIC SYSTEM 

EFFECTS/RATIONALE : 

SEAL IN SWITCHING VALVE FAILS; LOSS OF FLUID IN ONE HYDRAULIC 
SYSTEM. SYSTEM OPERATES NORMALLY ON SECONDARY SYSTEM. 


REFERENCES : 


C-4 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE; 

SUBSYSTEM: 
MDAC ID: 


10 / 02/86 

ELEVON 

104 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: SWITCHING VALVE 

FAILURE MODE: FAILS TO SWITCH 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) ELEVON 

2) FLOW CUTOFF VALVE 

3) SWITCHING VALVE 

4) 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

3/3 

TAL: 

2/1R 

ONORBIT: 

/NA 

AOA: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 2 ] 

B [ P ] 

C [ P ] 


LOCATION: WING TRAILING EDGE 

PART NUMBER: MC621-0014 


CAUSES: BROKEN OR FAILED SPRING; CONTAMINATED HYDRAULIC SYSTEM 

EFFECTS/RATIONALE : 

SPRING FAILS TO MAINTAIN RESTORING FORCE, PRIMARY SWITCHING VALVE 
CANNOT MAINTAIN POSITION FOR PRIMARY PRESSURE. SECONDARY SIDE OF 
SWITCHING VALVE CONTROLS PRESSURE TO ELEVON SYSTEM. SYSTEM 
OPERATES NOMINALLY. 


REFERENCES : 


C-5 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 02/86 

ELEVON 

105 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: SWITCHING VALVE 

FAILURE MODE: COMPONENT RUPTURE 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) ELEVON 

2) FLOW CUTOFF VALVE 

3) SWITCHING VALVE 

4) 

5) 

6 ) 

7) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

1/1 

LIFTOFF: 

3/3 

TAL: 

1/1 

ONORBIT: 

/NA 

AO A: 

1/1 

DEORBIT: 

1/1 

ATO: 

1/1 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: WING TRAILING EDGE 

PART NUMBER: MC621-0014 


CAUSES: FATIGUE 

EFFECTS /RATI ONALE : 

COMPONENT HOUSING FAILS DOWNSTREAM OF SWITCHING VALVE. LOSS OF 
HYDRAULIC FLUID AND ELEVON MOTION/CONTROL. 


REFERENCES: 


C-6 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 02/86 

ELEVON 

106 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


ITEM: CHECK VALVE 

FAILURE MODE: FAILS CLOSED 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) ELEVON 

2) FLOW CUTOFF VALVE 

3) SWITCHING VALVE 

4) CHECK VALVE 

5) 

6 ) 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FU 

PRELAUNCH: 

3/3 

RTLS: 

1/1 

LIFTOFF: 

3/3 

TAL: 

1/1 

ONORBIT: 

3/3 

AO A: 

1/1 

DEORBIT: 

1/1 

ATO: 

i/i 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: WING TRAILING EDGE 

PART NUMBER: MC621-0014 


CAUSES: CONTAMINATED HYDRAULIC SYSTEM 

EFFECTS/RATIONALE: 

PRIMARY ACTUATOR STARVED OF HYDRAULIC FLUID AND PRESSURE 
OF ELEVON MOVEMENT AND CONTROL. 


REFERENCES : 


HDW/FUNC 

1/1 

1/1 


LOSS 


C-7 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

10/02/86 

HIGHEST CRITICALITY 

HDW/FUNC 

SUBSYSTEM: 

ELEVON 

FLIGHT: 

2/1R 

MDAC ID: 

107 

ABORT: 

2/1R 

ITEM: 

CHECK VALVE 



FAILURE MODE: FAILS OPEN 



LEAD ANALYST: J. RICCIO 

SUBSYS LEAD: J. RICCIO 



BREAKDOWN HIERARCHY: 

1) ELEVON 

2) FLOW CUTOFF VALVE 

3) SWITCHING VALVE 

4) CHECK VALVE 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

3/3 

TAL: 

2/1R 

ONORBIT: 

3/3 

AOA: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 2 ] 

B [ F ] 

C [ P ] 


LOCATION: WING TRAILING EDGE 

PART NUMBER: MC621-0014 


CAUSES: CONTAMINATED HYDRAULIC SYSTEM 

EFFECTS/RATIONALE : ' 

PRIMARY ACTUATOR ENCOUNTERS A HIGH HINGE MOMENT BACK-PRESSURING 
THE UPSTREAM SYSTEM. THE SWITCHING VALUE CANNOT OPERATE IF A 
HYDRAULIC SYSTEM IS LOST DURING THIS PERIOD. POSSIBLE LOSS OF 
LIFE AND VEHICLE. 


REFERENCES : 


C-8 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/22/86 

SUBSYSTEM: ELEVON 

MDAC ID: 108 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: FILTER - 15 MICRON 

FAILURE MODE: RESTRICTED FLOW 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 

BREAKDOWN HIERARCHY: 

1) ELEVON 

2) FLOW CUTOFF VALVE 

3) SWITCHING VALVE 

4) FILTER - 15 MICRON 

5) 

6 ) 

7) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

1/1 

LIFTOFF: 

3/3 

TAL: 

1/1 

ONORBIT: 

/NA 

AO A: 

1/1 

DEORBIT: 

1/1 

ATO: 

1/1 

LANDING/S AFING: 

3/3 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: WING TRAILING EDGE 

PART NUMBER: MC621-0014 


CAUSES: HYDRAULIC SYSTEM CONTAMINATED 

EFFECTS/RATIONALE: 

SECONDARY SIDE OF SYSTEM DEPRIVED OF FLUID AND PRESSURE; LOSS OF 
PRIMARY ACTUATOR CONTROL/MOTION. 


REFERENCES : 


C-9 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/22/86 

SUBSYSTEM: ELEVON 

MDAC ID: 109 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: SERVO VALVE 

FAILURE MODE: JAMMED PISTON; FLAPPER VALVE FAILS 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 

BREAKDOWN HIERARCHY: 

1) ELEVON 

2) FLOW CUTOFF VALVE 

3) SWITCHING VALVE 

4) FILTER - 15 MICRON 

5) SERVO VALVE 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

3/3 

TAL: 

2/1R 

ONORBIT: 

/NA 

AOA: 

2/1R 

DEORBIT; 

2/1R 

ATO: 

2/1R 

LANDING/ SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 2 ] 

B [ P ] 

C [ P ] 


LOCATION: WING TRAILING EDGE 

PART NUMBER: MC621-0014 


CAUSES; CONTAMINATION IN SYSTEM, LOSS OF ASA CHANNEL 


EFFECTS/RATIONALE : 

ONE OF FOUR SERVO VALVES BIND; REMAINING THREE SERVO VALVES 
OVERDRIVE THE JAMMED SYSTEM. PRIMARY ACTUATOR FUNCTIONS 
NOMINALLY. 


REFERENCES : 


C-10 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

HDW/FUNC 
3/3 
3/3 


BREAKDOWN HIERARCHY: 

1) ELEVON 

2) FLOW CUTOFF VALVE 

3) SWITCHING VALVE 

4) FILTER - 15 MICRON 

5) SERVO VALVE 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

/NA 

AO A: 

3/3 

DEORBIT: 

3/3 

ATO: 

3/3 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/01/86 

ELEVON 

110 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


ITEM: SERVO VALVE 

FAILURE MODE: INTERNAL LEAKAGE 


LEAD ANALYST: J. RICCIO 


SUBSYS LEAD: J. RICCIO 


LOCATION: WING TRAILING EDGE 

PART NUMBER: MC621-0014 


CAUSES: DAMAGED SEALS-FOREIGN MATERIALS IN HYDRAULIC SYSTEM 

EFFECTS/RATIONALE : 

BARRIER SEALS PREVENT LEAKAGE OF FLUID EXTERNAL TO COMPONENTS; 
SYSTEM OPERATES NORMALLY. 


REFERENCES : 


C-ll 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/22/86 

SUBSYSTEM: ELEVON 

MDAC ID: 111 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: SERVO VALVE RESTRICTOR 

FAILURE MODE: PLUGGED 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) ELEVON 

2) FLOW CUTOFF VALVE 

3) SWITCHING VALVE 

4) FILTER - 15 MICRON 

5) SERVO VALVE 

6) SERVO VALVE RESTRICTOR 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

3/3 

TAL: 

2/1R 

ONORBIT: 

/NA 

AO A: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 2 ] 

B [ F ] 

C [ P ] 


LOCATION: WING TRAILING EDGE 

PART NUMBER: MC621-0014 


CAUSES: CONTAMINATED HYDRAULIC SYSTEM 

EFFECTS/RATIONALE : 

NO DELTA PRESSURE ACROSS SERVO VALVE; LOSS OF ONE SERVO VALVE, 
THREE REMAINING VALVES OPERATE ELEVON NOMINALLY. 


REFERENCES : 


C-12 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/22/86 

SUBSYSTEM: ELEVON 

MDAC ID: 112 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: BYPASS VALVE 

FAILURE MODE: FAILS TO OPEN/CLOSE 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 

BREAKDOWN HIERARCHY: 

1) ELEVON 

2) FLOW CUTOFF VALVE 

3) SWITCHING VALVE 

4) FILTER - 15 MICRON 

5) SERVO VALVE 

6) BYPASS VALVE 

7) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

3/3 

TAL: 

2/1R 

ONORBIT: 

/NA 

AOA: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/S AFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 2 ] 

B [ P ] 

C [ P ] 


LOCATION: WING TRAILING EDGE 

PART NUMBER: MC621-0014 


CAUSES: JAMMED SPOOL, BROKEN SPRING, LOSS OF ASA SIGNAL 


EFFECTS/RATIONALE : 

THREE REMAINING SERVO VALVES OVERDRIVE THE SYSTEM IF BYPASS VALVE 
DOES NOT OPEN WHEN SECONDARY DELTA PRESSURE >2200 PSID. SYSTEM 
FUNCTIONS NOMINALLY. 


REFERENCES : 


C-13 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

9/24/86 

HIGHEST CRITICALITY 

HDW/FUNC 

SUBSYSTEM: 

ELEVON 

FLIGHT: 

2/1R 

MDAC ID: 

113 

ABORT: 

2/1R 

ITEM: 

BYPASS VALVE 

FILTER-100 MICRON 


FAILURE MODE: PLUGGED 



LEAD ANALYST: J. RICCIO 

SUBSYS LEAD: J. RICCIO 



BREAKDOWN HIERARCHY: 

1) ELEVON 

2) FLOW CUTOFF VALVE 

3) FILTER - 15 MICRON 

4) SERVO VALVE 

5) BYPASS VALVE 

6) BYPASS VALVE FILTER-100 MICRON 

7) 

8 ) 

9) 

CRITICALITIES 

HDW/FUNC 
2/1R 
2/1R 
2/1R 
2/1R 


c [ P ] 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

3/3 

RTLS 

LIFTOFF: 

3/3 

TAL: 

ONORBIT: 

/NA 

AO A: 

DEORBIT: 

2/1R 

ATO: 

LANDING/ SAFING: 

3/3 


REDUNDANCY SCREENS: 

A [ 2 ]" 

B [ F ] 


LOCATION: WING TRAILING EDGE 

PART NUMBER: MC62 1-0014 


CAUSES: HYDRAULIC SYSTEM CONTAMINATED 


EFFECTS/RATIONALE : > ^ 

BYPASS VALVE UNABLE TO RELIEVE SECONDARY HYDRAULIC PRESSURE FROM 
QUAD CHANNELS; REMAINING SYSTEMS OVERDRIVES THE NON OPERATIONAL 
SERVO CHANNEL. 


REFERENCES : 


C-14 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/24/86 

SUBSYSTEM: ELEVON 

MDAC ID: 114 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: SECONDARY DELTA PRESSURE TRANSDUCER 

FAILURE MODE: LOSS OF OUTPUT 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 

BREAKDOWN HIERARCHY: 

1) ELEVON 

2) FLOW CUTOFF VALVE 

3) SWITCHING VALVE 

4) FILTER - 15 MICRON 

5) SERVO VALVE 

6) BYPASS VALVE 

7) SECONARY DELTA PRESSURE TRANSDUCER 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

3/3 

TAL: 

2/1R 

ONORBIT: 

/NA 

AOA: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/S AFING: 
REDUNDANCY SCREENS: 

3/3 

A [ 2 ] 

B [ P ) 

c [ p ] 


LOCATION: WING TRAILING EDGE 

PART NUMBER: MC621-0014 


CAUSES: BROKEN OR BINDING SPRING; LOSS OF ASA CHANNEL 

EFFECTS/RATIONALE : 

BYPASS VALVE OPENS REMOVING SERVO VALVE FROM LOOP. THREE 
REMAINING SECONDARY SYSTEMS OVERDRIVE THE FAULTY CHANNEL. FULL 
ACTUATOR FUNCTION. 


REFERENCES : 


C-15 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/24/86 

SUBSYSTEM: ELEVON 

MDAC ID: 115 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: POWER VALVE 

FAILURE MODE: RUPTURED HOUSING 


LEAD ANALYST: J. RICCIO 


SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) ELEVON 

2) FLOW CUTOFF VALVE 

3) SWITCHING VALVE 

4) FILTER - 15 MICRON 

5) SERVO VALVE 

6) BYPASS VALVE 

7) POWER VALVE 

3 ) 

9) 



CRITICALITIES 

CGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

3/3 

RTLS 

LIFTOFF: 

3/3 

TAL: 

ONORBIT: 

/NA 

AOA: 

DEORBIT: 

1/1 

ATO: 

LANDING/SAFING: 

3/3 



HDW/FUNC 

1/1 

1/1 

1/1 

1/1 


REDUNDANCY SCREENS: A [NA ] B [NA 


C [NA ] 


LOCATION: WING TRAILING EDGE 

PART NUMBER: MC621-0014 


CAUSES: FATIGUE 


EFFECTS/RATIONALE : 

LOSS OF ALL HYDRAULIC FLUID, SECONDARY PRESSURE, AND ASSOCIATED 
PRIMARY ACTUATOR MOTION CONTROL. 


REFERENCES 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/24/86 

SUBSYSTEM: ELEVON 

MDAC ID: 116 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: POWER VALVE 

FAILURE MODE: JAMMED 


LEAD ANALYST: J. RICCIO 


SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) ELEVON 

2) FLOW CUTOFF VALVE 

3) SWITCHING VALVE 

4) FILTER - 15 MICRON 

5) SERVO VALVE 

6) BYPASS VALVE 

7) POWER VALVE 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

1/1 

LIFTOFF: 

3/3 

TAL: 

1/1 

ONORBIT: 

/NA 

AOA: 

1/1 

DEORBIT: 

1/1 

ATO: 

1/1 

LANDING/S AFING: 

3/3 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: WING TRAILING EDGE 

PART NUMBER: MC621-0014 


CAUSES: HYDRAULIC SYSTEM CONTAMINATED 

\ ■ 

EFFECTS/RATIONALE : 

LOSS OF ALL DOWNSTREAM MOTION; UNABLE TO CONTROL OR MOVE ELEVON. 


REFERENCES 



INDEPENDENT ORBITER ASSESSMENT: 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/24/86 

SUBSYSTEM: ELEVON 

MDAC ID: 117 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: PRIMARY ACTUATOR 

FAILURE MODE: EXTERNAL LEAKAGE 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 

BREAKDOWN HIERARCHY: 

1) ELEVON 

2) FLOW CUTOFF VALVE 

3) SWITCHING VALVE 

4) FILTER - 15 MICRON 

5) SERVO VALVE 

6) BYPASS VALVE 

7) POWER VALVE 

8) PRIMARY ACTUATOR 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

1/1 

LIFTOFF: 

3/3 

TAL: 

1/1 

ONORBIT: 

/NA 

AO A: 

1/1 

DEORBIT: 

1/1 

ATO: 

1/1 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: WING TRAILING EDGE 

PART NUMBER: MC62 1-0014 


CAUSES: CONTAMINATION IN SYSTEM, CRACKED HOUSING, GROSS LEAKAGE, 

SEAL FAILURE 

EFFECTS/RATIONALE : 

LOSS OF ELEVON MOTION AND CONTROL. 


REFERENCES : 


C-18 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/30/86 

SUBSYSTEM: ELEVON 

MDAC ID: 118 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: LVDT 

FAILURE MODE: LOSS OF OUTPUT 


LEAD ANALYST: J. RICCIO 


SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) ELEVON 

2) FLOW CUTOFF VALVE 

3) SWITCHING VALVE 

4) FILTER 15 - MICRON 

5) SERVO VALVE 

6) BYPASS VALVE 

7) POWER VALVE 

8) PRIMARY ACTUATOR 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

1/1 

LIFTOFF: 

3/3 

TAL: 

1/1 

ONORBIT: 

/NA 

AO A: 

1/1 

DEORBIT: 

1/1 

ATO: 

1/1 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: WING TRAILING EDGE 

PART NUMBER: MC621-0014 


CAUSES: FRACTURE OF LVDT SUPPORT BASE 

EFFECTS/RATIONALE : 

LOSS OF ALL OUTPUT AND POSITION FEEDBACK FROM PRIMARY ACTUATOR? 
INABILITY TO DETERMINE ELEVON POSITION. 


REFERENCES 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/01/86 

ELEVON 

119 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: PRIMARY ACTUATOR 

FAILURE MODE: STRUCTURAL FAILURE 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 

BREAKDOWN HIERARCHY: 

1) ELEVON 

2) FLOW CUTOFF VALVE 

3) SWITCHING VALVE 

4) FILTER - 15 MICRON 

5) SERVO VALVE 

6) BYPASS VALVE 

7) POWER VALVE 

8) PRIMARY ACTUATOR 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

1/1 

LIFTOFF: 

3/3 

TAL: 

1/1 

ONORBIT: 

/NA 

AO A: 

1/1 

DEORBIT: 

1/1 

ATO: 

1/1 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: WING TRAILING EDGE 

PART NUMBER: MC62 1-0014 


CAUSES: FATIGUE 

EFFECTS/RATIONALE : 

ACTUATOR PISTON COMPONENTS (RODEND, TAILSTOCK, RETAINER, ETC.) 
FAILS; LOSS OF ELEVON CONTROL AND MOTION, 


REFERENCES : 


C-20 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

10/01/86 HIGHEST CRITICALITY 

ELEVON FLIGHT: 

120 ABORT: 

PRIMARY ACTUATOR 
FAILURE MODE: INTERNAL LEAKAGE 

LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 

BREAKDOWN HIERARCHY: 


1) 

ELEVON 

2) 

FLOW CUTOFF VALVE 

3) 

SWITCHING VALVE 

4) 

FILTER - 15 MICRON 

5) 

SERVO VALVE 

^ 6) 

BYPASS VALVE 

7) 

POWER VALVE 

8) 

PRIMARY ACTUATOR 

- 9) 



CRITICALITIES 



FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 


PRELAUNCH: 

3/3 

RTLS: 

3/3 


LIFTOFF: 

3/3 

TAL: 

3/3 

= - 

ONORBIT: 

/NA 

AOA: 

3/3 

= - 

DEORBIT: 

3/3 

ATO: 

3/3 


LANDING/SAFING: 

3/3 



iii i >3i 1 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: WING TRAILING EDGE 

PART NUMBER: MC62 1-0014 


CAUSES: DAMAGED SEALS-FOREIGN MATERIAL IN HYDRAULIC SYSTEM. 

EFFECTS/RATIONALE : 

BARRIER SEALS PREVENT LEAKAGE OF FLUID EXTERNAL TO COMPONENT; 
SYSTEM OPERATES NORMALLY. 


HDW/FUNC 

3/3 

3/3 


DATE: 

SUBSYSTEM: 
MDAC ID: 

ITEM: 


REFERENCES : 


C-21 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/01/86 

ELEVON 

121 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 3/1R 


ITEM: PRIMARY DELTA PRESSURE TRANSDUCER 

FAILURE MODE: LOSS OF OUTPUT 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 

BREAKDOWN HIERARCHY: 

1) ELEVON 

2) FLOW CUTOFF VALVE 

3) SWITCHING VALVE 

4) FILTER 15 MICRON 

5) SERVO VALVE 

6) BYPASS VALVE 

7) POWER VALVE 

8) PRIMARY ACTUATOR 

9) PRIMARY DELTA PRESSURE TRANSDUCER 


FLIGHT PHASE 

CRITICALITIES 
HDW/FUNC ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/3 

TAL: 

3/1R 

ONORBIT: 

/NA 

AOA: 

3/1R 

DEORBIT: 

3/1R 

ATO: 

3/1R 

LANDING/SAFING: 
REDUNDANCY SCREENS: 

3/3 

A [ 2 ] 

B [ P ] 

C [ P ] 


LOCATION: WING TRAILING EDGE 

PART NUMBER: MC621-0014 


CAUSES: BROKEN OR BINDING SPRING; LOSS OF ASA CHANNEL 

EFFECTS/RATIONALE : ¥ ^ 

LOSS OF PRIMARY CHANNEL, FULL FUNCTION ON THREE REMAINING 
CHANNELS . 


REFERENCES : 


C-22 



INDEPENDENT ORBTTER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

HDW/FUNC 
3/1R 
3/1R 

ITEM: PRIMARY ACTUATOR DELTA PRESSURE TRANSDUCER 

FAILURE MODE: ERRONEOUS OR NO OUTPUT 


DATE: 

SUBSYSTEM: 
MDAC ID: 


9/25/86 

ELEVON 

122 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 

BREAKDOWN HIERARCHY: 



1) 

ELEVON 


2) 

FLOW CUTOFF VALVE 


3) 

SWITCHING VALVE 


4) 

FILTER - 15 MICRON 


5) 

SERVO VALVE 


6) 

BYPASS VALVE 


7) 

POWER VALVE 


8) 

PRIMARY ACTUATOR 


9) 

PRIMARY DELTA PRESSURE TRANSDUCER 


CRITICALITIES 



FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 


PRELAUNCH: 

3/3 

RTLS: 

3/1R 


LIFTOFF: 

3/3 

TAL: 

3/1R 


ONORBIT: 

/NA 

AOA: 

3/1R 


DEORBIT: 

LANDING/SAFING: 

3/1R 

3/3 

ATO: 

3/1R 


REDUNDANCY SCREENS: 

A [ 2 ] 

B [ P ] 

C [ P ] 


LOCATION: WING TRAILING EDGE 

PART NUMBER: MC621-0014 


CAUSES: LOSS OF ASA CHANNEL OR POWER; OPEN LEAD 

EFFECTS/RATIONALE : 

THREE REMAINING SYSTEMS FEEDBACK ACTUATOR POSITION? SYSTEM 
OPERATES NORMALLY. 


REFERENCES : 


i 


C-23 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 02/86 

ELEVON 

123 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


ITEM: HEATER 

FAILURE MODE: FAILS ON 


LEAD ANALYST: J. RICCIO 


SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) ELEVON 

2) FLOW CUTOFF VALVE 

3) SWITCHING VALVE 

4) FILTER - 15 MICRON 

5) SERVO VALVE 

6) BYPASS VALVE 

7) POWER VALVE 

8) PRIMARY ACTUATOR 

9) HEATER 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AOA: 

3/3 

DEORBIT: 

3/3 

ATO: 

3/3 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


IX5CATION : WING TRAILING EDGE 

PART NUMBER: MC621-0014 


CAUSES: VIBRATION 

EFFECTS/RATIONALE : 

HEATING ELEMENT CONTINUOUSLY POWERED; AN OVER-TEMPERATURE 
RESULTS; SYSTEM DESIGNED TO WITHSTAND EXCESS HEAT LOAD. 


REFERENCES : 


HDW/FUNC 

3/3 

3/3 


HEATER 


C-24 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 02/86 

ELEVON 

124 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: HEATER 

FAILURE MODE: FAILS OFF 


LEAD ANALYST: J. RICCIO 


SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) ELEVON 

2) FLOW CUTOFF VALVE 

3) SWITCHING VALVE 

4) FILTER - 15 MICRON 

5) SERVO VALVE 

6) BYPASS VALVE 

7) POWER VALVE 

8) PRIMARY ACTUATOR 

9) HEATER 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AOA: 

3/3 

DEORBIT: 

3/3 

ATO: 

3/3 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: WING TRAILING EDGE 

PART NUMBER: MC621-0014 


CAUSES: VIBRATION OPENS LEAD TO UNIT; LOSS OF POWER TO HEATER 

EFFECTS/RATIONALE : 

HEATING ELEMENT DOES NOT RECEIVE POWER; BACKUP HEATER CONDITIONS 
ACTUATOR OR SYSTEM CAN BE EXCERCISED TO PREVENT UNDER TEMPERATURE 
SITUATION. 


REFERENCES 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/03/86 

ELEVON 

125 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: SERVO ACTUATOR 

FAILURE MODE: INTERNAL LEAKAGE 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 

BREAKDOWN HIERARCHY: 

1) ELEVON 

2) FLOW CUTOFF VALVE 

3) SWITCHING VALVE 

4) FILTER - 15 MICRON 

5) SERVO ACTUATOR 

6 ) 

7 ) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

3/3 

TAL: 

2/1R 

ONORBIT: 

/NA 

AO A: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 2 ] 

B [ F ] 

C [ P ] 

LOCATION: WING TRAILING EDGE 

PART NUMBER: MC621-0014 




CAUSES: CONTAMINATED HYDRAULIC SYSTEM 


EFFECTS/RATIONALE: 

SEAL FAILURE -ANY COMPONENT IN SERVO ACTUATOR SYSTEM; BARRIER SEAL 
DESIGN ON ALL SEALS -SYSTEM OPERATES NORMALLY. 


REFERENCES : 


C-26 


APPENDIX D 

POTENTIAL CRITICAL ITEMS 


MDAC ID 

ITEM 

FAILURE MODE 

103 

Switching valve 

Seal failure 

104 

Switching valve 

Fails to switch 

105 

Switching valve 

Component rupture 

106 

Check valve 

Fails closed 

107 

Check valve 

Fails open 

108 

Filter - 15 miron 

Restricted flow 

109 

Servovalve 

Jammed piston 

111 

Servovalve restrictor 

Plugged 

112 

Bypass valve 

Fails to open/close 

113 

Filter - 100 micron 

Plugged 

114 

Secondary delta P xducer 

Loss of output 

115 

Power valve 

Ruptured housing 

116 

Power valve 

Jammed 

117 

Primary actuator 

External leakage 

118 

LVDT 

Loss of output 

119 

Primary actuator 

Structural failure 

124 

Heater 

Fails off 

125 

Servo actuator 

Internal leakage 




